Cross site scripting

Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.5301 and earlier Movable Type Advanced 7 Series, Movable Type 6.8.7 and earlier Movable Type 6 Series, Movable Type Advanced 6.8.7 and earlier Movable Type Advance...

Input validation

Improper neutralization of Server-Side Includes SSW within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable...

PT-2022-26995 · Unknown · Movable Type Premium Advanced +3

Name of the Vulnerable Software and Affected Versions: Movable Type versions 7 r.5301 and earlier Movable Type Advanced versions 7 r.5301 and earlier Movable Type Premium version 1.53 and earlier Movable Type Premium Advanced version 1.53 and earlier Description: The issue is related to the...

CVE-2022-45113

CVE-2022-45113 affects Six Apart Movable Type and related variants, where improper validation of input syntax enables a remote attacker to lure a user to a specially crafted URL on the Reset Password page to conduct a phishing attack. Affected versions include Movable Type 7 (r.5301 and earlier) ...

CVE-2022-43660

Improper neutralization of Server-Side Includes SSW within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable...

CVE-2022-45113

Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a remote unauthenticated attacker to set a specially crafted URL to the Reset Password page and conduct a phishing attack. Affected...

CVE-2022-45122

Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.5301 and earlier Movable Type Advanced 7 Series, Movable Type 6.8.7 and earlier Movable Type 6 Series, Movable Type Advanced 6.8.7 and earlier Movable Type Advance...

PT-2022-27405 · Unknown · Movable Type Premium +3

Name of the Vulnerable Software and Affected Versions: Movable Type versions 7 r.5301 and earlier Movable Type Advanced versions 7 r.5301 and earlier Movable Type versions 6.8.7 and earlier Movable Type Advanced versions 6.8.7 and earlier Movable Type Premium versions 1.53 and earlier Movable Typ...

PT-2022-27408 · Unknown · Movable Type Premium +3

Name of the Vulnerable Software and Affected Versions: Movable Type versions 7 r.5301 and earlier Movable Type Advanced versions 7 r.5301 and earlier Movable Type versions 6.8.7 and earlier Movable Type Advanced versions 6.8.7 and earlier Movable Type Premium version 1.53 and earlier Movable Type...

CVE-2022-45122

CVE-2022-45122 is an XSS vulnerability in Movable Type and related products (Movable Type 7, Movable Type Advanced 7, Movable Type 6, Movable Type Advanced 6, Movable Type Premium and Premium Advanced) that allows a remote unauthenticated attacker to inject arbitrary scripts. The issue affects mu...

CVE-2022-43660

The CVE-2022-43660 issue is an SSI (Server-Side Includes) handling vulnerability in Movable Type and related products. A remote authenticated attacker with the privilege “Manage of Content Types” could execute arbitrary Perl scripts or arbitrary OS commands via a crafted web page. Affected are Mo...

CVE-2022-43660

Improper neutralization of Server-Side Includes SSW within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable...

CVE-2022-45113

Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a remote unauthenticated attacker to set a specially crafted URL to the Reset Password page and conduct a phishing attack. Affected...

CVE-2022-45122

Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.5301 and earlier Movable Type Advanced 7 Series, Movable Type 6.8.7 and earlier Movable Type 6 Series, Movable Type Advanced 6.8.7 and earlier Movable Type Advance...

Multiple vulnerabilities in Movable Type

Overview Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below. Improper Validation of Syntactic Correctness of Input CWE-1286 - CVE-2022-45113 Cross-site Scripting CWE-79 - CVE-2022-45122 Improper Neutralization of Server-Side Includes SSI Within a Web Page CWE-9...

Six Apart Movable Type 代码注入漏洞

Six Apart Movable Type is an application from Six Apart USA. It provides features such as multiple users, comments, trackbacks, and threads. A security vulnerability exists in Six Apart Movable Type, which can be exploited to execute arbitrary Perl scripts and/or arbitrary operating system comman...

JVN#37014768: Multiple vulnerabilities in Movable Type

Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below. Improper Validation of Syntactic Correctness of Input CWE-1286 - CVE-2022-45113 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N| Base Score: 4.7 CVSS v2|...

Six Apart Movable Type 跨站脚本漏洞

Six Apart Movable Type is an application from Six Apart USA. It provides features such as multiple users, comments, references TrackBack, and themes. A security vulnerability exists in Six Apart Movable Type, which can be exploited by an attacker to execute arbitrary scripts on a web browser, and...

Six Apart Movable Type 输入验证错误漏洞

Six Apart Movable Type is an application from Six Apart USA. It provides features such as multi-user, commenting, referencing TrackBack, and threading. A security vulnerability exists in Six Apart Movable Type, which is caused by improper validation of the correctness of input syntax, and can be...

Movable Type < 6.8.3 / 7.x < 7.8.2 Remote Command Injection

Movable Type 6.8.3 / 7.x 7.8.2 contains an OS Command Injection vulnerability by sending a specially crafted POST request to the XMLRPC API. No source data...